A Fair Sampling Test for Ekert Protocol 
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We propose a local scheme to enhance the security of quantum key distribution in Ekert protocol 
(E91). Our proposal is a fair sampling test meant to detect an eavesdropping attempt that would 
use a biased sample to mimic an apparent violation of Bell inequalities. The test is local and non 
disruptive: it can be unilaterally performed at any time by either Alice or Bob during the production 
of the key, and together with the Bell inequality test. 



INTRODUCTION 

Ekert protocol [lj— uses entangled states to guaran- 
tee the secrecy of a key distributed to two parties (Alice 
and Bob). Identical measurements performed on a maxi- 
mally entangled state yield perfect correlation, which can 
be used to produce a shared key; while the secrecy of the 
key can be guaranteed by the violation of Bell inequalities 
measured for non-identical measurements. An uncondi- 
tional violation of Bell inequalities would guarantee that 
no local (hidden) variables exist that an eavesdropper 
(Eve) could exploit. It would mean unconditional pri- 
vacy: Eve could have full control of the detectors and the 
source, more advanced theory and technology, it would 
still be secure [2|. 

However, practical implementations of Ekert protocol 
have to be performed with photons, because a key dis- 
tribution protocol is useful only if Alice and Bob can 
be separated by macroscopic distances [4|. Photons are 
also restricted by the use of polarizing beam splitter to 
a wavelength domain for which standard photon coun- 
ters have a poor detection efficiency [5|, |6[ . It means that 
a rather heavy postselection is required: Alice and Bob 
must discard all measurements for which either of them 
failed to register a click at all [2| . The trouble is that lo- 
cal hidden- variable models that exploit this weakness can 
reproduce exactly the predictions of Quantum Mechanics 
7h as soon as the detection efficiency is lower than 83% 
8|4ll! . In the context of experiments on the foundations 
of Quantum Mechanics, the assumption of Fair Sampling 
is usually considered reasonable to support a violation of 
Bell inequalities, with the idea that Nature is not con- 
spiratory. In Quantum Key Distribution however, Eve is 
expected to conspire [12| . Alice and Bob should therefore 
assume that their sample is biased by Eve. Failure to ac- 
knowledge this weakness would leave all freedom to Eve 
to exploit it with a biased sample attack: the statistics on 
the detected sample would then only have the appearance 
of secrecy. This weakness should not be underestimated 
given that a successful quantum hacking has already been 
successfully implemented experimentally by means of a 
time-shifting attack [l3| . 
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FIG. 1. Standard Ekert protocol. Alice and Bob randomly 
switch their measurement settings. Pairs associated with 
identical measurement settings {if a = tps) are used to pro- 
duce a correlated key, while those associated to non-identical 
measurement settings {if a / ^b) are used to check the vio- 
lation of Bell inequality (and the security of the key). 



Naturally, this issue becomes critical if Eve manufac- 
tured the detectors, which means that Alice and Bob 
should thoroughly check that their detectors are func- 
tioning according to specifications [2]. However, we will 
argue here that even if the detectors owned by Alice and 
Bob are genuine photomultipliers or avalanche photodi- 
odes, Eve could still in principle force a biased sampling 
on these detectors by exploiting the thresholds of these 
detectors. Eve would only need to control the source and 
know the detectors well enough to exploit their thresh- 
olds, but she would not need to actually control them. 
We will thus propose below a fair sampling test to pre- 
vent such a biased-sample attack on threshold detectors. 



A BIASED-SAMPLE ATTACK ON EKERT 
PROTOCOL 

The motivation and concern for the possibility of a 
biased-sample attack is that avalanche photodiodes and 
photomultipliers are fundamentally threshold detectors. 
At the input, the energy must be higher than the band 
gap to trigger an avalanche or a photoelectron; while at 
the output, the current must be higher than a discrimi- 
nator value to be counted as a click yjj. This combined 
threshold could be exploited by Eve to obtain an appar- 
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ent violation of Bell inequalities on the detected sample 

We will assume throughout this paper that the source 
is controlled by Eve, that she can produce pulses that 
split classically according to Malus law in polarizing 
beamsplitters, and that these pulses are sensitive to the 
threshold in Alice's and Bob's detector. How Eve will ef- 
fectively produce such pulses is left to her, but it should 
be stressed that if each pulse contains at most one particle 
then the biased sampling described here would be inef- 
fective, because the energy seen at a detector would al- 
ways be the same regardless of the measurement settings. 
Eve could for instance produce pulses with several pho- 
tons of lower frequencies, possibly using non-linearities 
in threshold detectors [16j |. 

We will consider here simple models of threshold de- 
tectors: ideal threshold detectors, which produce a click 
with certainty if the energy E of the absorbed pulse is 
greater than a threshold <£; and linear threshold detector, 
which produce a click with a probability increasing lin- 
early with the energy above a threshold (possibly with 
a saturation value after which the probability no longer 
increases). 

The simplest way for Eve to obtain an apparent viola- 
tion of Bell inequalities reproducing exactly the predic- 
tions of Quantum Mechanics on the detected sample is to 
aim at reproducing the asymmetrical detection pattern 
of a Larsson-Gisin model jTl], [I?}- Those models are ad 
hoc, but it is in fact relatively straightforward for Eve to 
obtain these patterns with classical pulses and threshold 
detectors. 

For this purpose, Eve sends pairs of correlated pulses 
with energy Eq and polarization A, where A is a 
random variable uniformly distributed on the interval 
[— 7r/2, 7r/2]. Then she just needs to make sure that on 
one side (say, Alice) the detectors are ideal threshold de- 
tectors with Eo = 2$, while the other side (Bob) the de- 
tectors are linear threshold detectors, also with Eo = 2$. 
With the condition E = 2$, Malus' Law is cut by the 
bottom precisely at the intersection of the two channels 
(at \(f— A| = 7r/4). Consequently, Alice's always records a 
click in exactly one channel: channel 1 if \cpA — A| < 7r/4, 
channel otherwise; whereas on Bob's side the probabil- 
ity to get a click in the channel 1 varies with cos 2((fB — A) 
when \(fB — A| < 7r/4, and with sin2((^B — A) when 
\(fB — M > 7r/4in channel 0. The crucial feature of 
the resulting detection pattern is that the probability to 
obtain a click in either channel on Bob's side depends 
explicitly on A: it is maximum for \cps — A| = 0, and de- 
creases down to zero for \(fB — A| = 7r/4. The sampling is 
thus unfair, or biased, and leads to an apparent violation 
of Bell inequalities on the detected sample [ll|, yjj LL7j . 

An eavesdropping strategy would therefore consist in 
replacing the source of entangled photons with a classi- 
cal source of pulsed pairs correlated in polarization and 
designed to meet condition Eq = 2$. If Eve aims at 



reproducing the full correlation function as predicted by 
Quantum Mechanics, she would have to make sure that 
at one station (say, Alice) the threshold detectors react 
ideally to the pulses, whereas at the other station (Bob) 
the threshold detectors react linearly. However, if Alice 
and Bob are only measuring a few points of the corre- 
lation function (those giving maximum violation of Bell 
inequality), as is done in Ekert protocol, Eve can lift this 
constraint and work with identical threshold detectors on 
both sides (either linear or ideal). Alice and Bob would 
then observe a maximal violation of Bell inequalities on 
the subset of detected pairs, and would thus wrongly be- 
lieve that their key is secure while in fact Eve's knowledge 
would in principle be maximum. 

COUNTERMEASURE: A FAIR SAMPLING TEST 

In order to prevent Eve from using this attack, the 
obvious solution consists in increasing the efficiency to 
reach 83%. However, this proves difficult with thresh- 
old detectors. Decreasing the band gap threshold — or 
increasing the operating temperature — does increase the 
efficiency of the detectors, but only at the cost of higher 
dark count rates. Unless special detectors operating near 
absolute zero temperature are used, such as Transition- 
Edge Sensors (which are too cumbersome and slow to be 
practical solution to QKD), this can be considered a gen- 
eral rule that applies to any detectors, and fundamentally 
limits their efficiencies. 

Another suggestion is to artificially complete the de- 
tected sample by randomly assigning or 1 to non- 
detected pulses [18[, so that the required efficiency to 
produce a useful key is lowered to 50%. However, we 
would like to argue that the drawback of this method is 
that introducing some random results would be bound to 
decrease the violation of Bell inequality measured on the 
completed sample, thus preventing a security check of the 
key unless one does so on the uncompleted sample (which 
would again reintroduce the 83% efficiency bound). 

Our proposal consists in testing the fairness of the sam- 
ple by analyzing the output channels of the polarizing 
beamsplitters, instead of simply feeding detectors with 
them. We keep the standard design of Ekert protocol, 
with two polarizing beamsplitters on each side (Alice and 
Bob) projecting the incoming pulses on random bases cpA 
and tpBi as depicted on Fig. [IJ but we replace each de- 
tectors by a polarimeter [19[: a polarizing beamsplitter 
followed by a detector at each output. Consider Alice's 
side (see Fig. [2j). We label the polarimeter in channel 1 as 
Ai, the orientation of its polarizing beam-splitter as 
and the detectors in the transmitted and reflected output 
as and A~{ respectively. Similarly, the polarimeter in 
channel is labeled Aq, the orientation of its polarizing 
beam-splitter and the detectors in the transmitted 
and reflected output are Aq and Aq respectively. Bob 
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FIG. 2. Fair Sampling test on Alice's side. The detector in 
channel 1 is replaced by a polarimeter A± with two detectors 
Af and having the same efficiency 77. The detector in 
channel is replaced by a polarimeter Ao with two detectors 
A q and Aq , also with efficiency 77. Ekert protocol is thus 
unaltered by our test: polarimeter A\ is equivalent to the 
detector in channel 1 in Fig. [T] with the same efficiency 77, 
and polarimeter Ao is equivalent to the detector in channel 
with efficiency 77. Similar results would be obtained for 
polarimeter Ao, and for Bob's polarimeters. 



would proceed similarly with two polarimeters labeled B\ 
and Bo. 

In case of a genuine source of entangled photons, noth- 
ing is changed for Ekert protocol, as long as all the de- 
tectors have the same efficiency 77. Each polarimeter can 
then be considered as one detector with quantum effi- 
ciency 77. The polarimeter A\ can be seen as one single 
detector in channel 1, in which the orientation 0a 1 has no 
influence on the result: a photon exiting the polarizing 
beam-splitter cp A through channel 1 will be detected in 
either output channel of polarimeter A\ with a probabil- 
ity 77. Similarly, polarimeter Aq can be seen as one single 
detector in channel 0, where the orientation 0a o plays no 
role whatsoever, and the same goes for Bob's setup. The 
production of the key and the verification of the violation 
of Bell inequalities is thus unaltered by our fair sampling 
test setup in case of a genuine source of entangled pho- 
tons, because the additional measurement settings 0a 1 , 
0a o , #Bi and 0b 1 controlled by Alice and Bob have no in- 
fluence on the measurement results in case of a genuine 
source of entangled photons. 

However, they have a strong influence in the case of a 
biased-sample attack by Eve. Let us consider the simpler 
case of ideal threshold detectors mentioned above. By 
Malus law, the energy of the pulse reaching Alice's Af 
detector is 

E A+ = E cos 2 (<p A - Al )cos 2 (ip A - A). (1) 



Starting from a uniform distribution of the polariza- 
tion A of pulses on the circle, we write that |Pa<^a| = 
\P A +(E A +)dE A +\, so that the probability to get an en- 
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where £ max = £"0 cos 2 ((pA — 0a x ) is the maximum energy 
reaching the detector (by Malus' law). 

The probability to obtain a click in an ideal thresh- 
old detector placed at the transmitted output (+) of po- 
larimeter A\ is then simply the integral of this density 
distribution over the energy reaching the detector, from 
the threshold to ^ max : 
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Similarly the probability to obtain a click in an ideal 
threshold detector positioned at the reflected output ( — ) 
of polarimeter A\ is 
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In the case of linear threshold detectors, the analyt- 
ical results are more complicated since the probability 
to get a click for an energy E + dE is not always equal 
to 1, but the principle of calculation remains the same: 
integrate the product of the probability density distribu- 
tion by the probability of obtaining a click for a given 
energy. The analytical results for linear threshold are 
qualitatively similar to that of ideal threshold detectors. 
The results in the case Eq = 2$ — which is leading to a 
violation of Bell inequalities exactly reproducing the pre- 
dictions of Quantum Mechanics — are displayed in Fig. [3j 
the probability to get a click in polarimeter A\ depends 
on I ip a — 0a 1 I- It is maximum for \cpA — 0a 1 | = + kir/2, 
and reaches zero for \cpA — ^aJ = + kir/2. Simi- 
lar results would be obtained for polarimeter Aq , and for 
Bob's polarimeters. 

This fair sampling test can be implemented very sim- 
ply on Alice's side by fixing 0a 1 = @a — 0. The random 
switching in Ekert protocol (Fig. [1] and Fig. [2j) ensures 
that the points at and 7r/4 are both scanned automat- 
ically. Any significant difference in the number of single 
counts recorded when cfA = and (fA = tt/4 would be- 
tray Eve's attempt to bias the sample through a biased- 
sample attack on the threshold detectors. Similarly, Bob 
would chose 0b 1 = 0b o = tt/8, and compare the number 
of singles when cps = — tt/8 and cps = tt/8. 
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FIG. 3. Analytical Results in case of biased-sample attack 
on threshold detectors in Alice's polarimeter A±, with Eo — 
2$. The probability to get a click in depends on \cp A — 
Al \. From to j and from ^ to 7r, only detector can 
click, whereas from j to ^ only detector can click. By 
contrast, in case of a genuine source of entangled photons, 
the probability to get a click in these channels is governed by 
Malus law's cos 2 (cp A — Al ) and sin 2 ((p A — Al ) (not shown 
here), and the probability to get a click in either channel 
therefore adds up to a constant independent of \(p A — Al \. 

CONCLUSION 

Our fair sampling test can be implemented during the 
production of the key and together with the violation of 
Bell inequality check, so that it seems hard to bypass it 
without reducing the visibility of the correlation. For in- 
stance, increasing the energy of the pulses with respect 
to the threshold would tend to reduce the dip in the fair 
sampling test, but it would give rise to double counts 
and reduce the visibility of the correlation at the same 
time (weaker violation of Bell inequalities). The combi- 
nation of a Bell inequality test with a monitoring of the 
double counts and our local fair sampling test therefore 
constitutes a solid scheme against eavesdropping a E91 
protocol using a biased-sample attack. It should also be 



noted that the use of four detectors on each side can serve 
other purposes, like shielding Alice and Bob from a time- 
shift attack [20|. In principle, similar fair sampling tests 
could be implemented in other QKD protocol, by replac- 
ing passive detectors in each channel by a device with 
the same efficiency that would analyze further whichever 
degree of freedom is used to encode the key, instead of 
simply feeding detectors with it. 
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